Engineering with Logic

Author:

Bishop Steve1,Fairbairn Matthew1,Mehnert Hannes2,Norrish Michael3,Ridge Tom4,Sewell Peter1,Smith Michael1,Wansbrough Keith1

Affiliation:

1. University of Cambridge, UK

2. robur.io, Center for the Cultivation of Technology, Germany

3. Data61, CSIRO and Australian National University, Australia

4. University of Leicester, UK

Abstract

Conventional computer engineering relies on test-and-debug development processes, with the behavior of common interfaces described (at best) with prose specification documents. But prose specifications cannot be used in test-and-debug development in any automated way, and prose is a poor medium for expressing complex (and loose) specifications. The TCP/IP protocols and Sockets API are a good example of this: they play a vital role in modern communication and computation, and interoperability between implementations is essential. But what exactly they are is surprisingly obscure: their original development focused on “rough consensus and running code,” augmented by prose RFC specifications that do not precisely define what it means for an implementation to be correct. Ultimately, the actual standard is the de facto one of the common implementations, including, for example, the 15 000 to 20 000 lines of the BSD implementation—optimized and multithreaded C code, time dependent, with asynchronous event handlers, intertwined with the operating system, and security critical. This article reports on work done in the Netsem project to develop lightweight mathematically rigorous techniques that can be applied to such systems: to specify their behavior precisely (but loosely enough to permit the required implementation variation) and to test whether these specifications and the implementations correspond with specifications that are executable as test oracles . We developed post hoc specifications of TCP, UDP, and the Sockets API, both of the service that they provide to applications (in terms of TCP bidirectional stream connections) and of the internal operation of the protocol (in terms of TCP segments and UDP datagrams), together with a testable abstraction function relating the two. These specifications are rigorous, detailed, readable, with broad coverage, and rather accurate. Working within a general-purpose proof assistant (HOL4), we developed language idioms (within higher-order logic) in which to write the specifications: operational semantics with nondeterminism, time, system calls, monadic relational programming, and so forth. We followed an experimental semantics approach, validating the specifications against several thousand traces captured from three implementations (FreeBSD, Linux, and WinXP). Many differences between these were identified, as were a number of bugs. Validation was done using a special-purpose symbolic model checker programmed above HOL4. Having demonstrated that our logic-based engineering techniques suffice for handling real-world protocols, we argue that similar techniques could be applied to future critical software infrastructure at design time, leading to cleaner designs and (via specification-based testing) more robust and predictable implementations. In cases where specification looseness can be controlled, this should be possible with lightweight techniques, without the need for a general-purpose proof assistant, at relatively little cost.

Funder

NICTA

St Catharine's College Heller Research Fellowship

EC FET-GC project

CMI UROP

EPSRC Programme

REMS: Rigorous Engineering for Mainstream Systems

ERC

EPSRC

EC Thematic Network

EPSRC Leadership Fellowship

Royal Society University Research Fellowship

Australian Research Council

Australian Government's

Publisher

Association for Computing Machinery (ACM)

Subject

Artificial Intelligence,Hardware and Architecture,Information Systems,Control and Systems Engineering,Software

Reference102 articles.

1. Jade Alglave and Luc Maranget. 2017. Simulating memory models with herd7. Retrieved from http://diy.inria.fr/doc/herd.html. Jade Alglave and Luc Maranget. 2017. Simulating memory models with herd7. Retrieved from http://diy.inria.fr/doc/herd.html.

2. Herding Cats

3. Verifying network protocol implementations by symbolic refinement checking. In Proceedings of Computer Aided Verification (CAV'11);Alur Rajeev;LNCS,2001

4. Design guidelines for robust Internet protocols

Cited by 9 articles. 订阅此论文施引文献 订阅此论文施引文献,注册后可以免费订阅5篇论文的施引文献,订阅后可以查看论文全部施引文献

1. Network Simulator-Centric Compositional Testing;Lecture Notes in Computer Science;2024

2. Curiously Empty Intersection of Proof Engineering and Computational Sciences;Computational Methods in Applied Sciences;2023

3. An Online English Writing Evaluation System Using Deep Learning Algorithm;Mobile Information Systems;2022-08-12

4. Prognosis;Proceedings of the 2021 ACM SIGCOMM 2021 Conference;2021-08-09

5. Model-based testing of networked applications;Proceedings of the 30th ACM SIGSOFT International Symposium on Software Testing and Analysis;2021-07-11

同舟云学术

1.学者识别学者识别

2.学术分析学术分析

3.人才评估人才评估

"同舟云学术"是以全球学者为主线,采集、加工和组织学术论文而形成的新型学术文献查询和分析系统,可以对全球学者进行文献检索和人才价值评估。用户可以通过关注某些学科领域的顶尖人物而持续追踪该领域的学科进展和研究前沿。经过近期的数据扩容,当前同舟云学术共收录了国内外主流学术期刊6万余种,收集的期刊论文及会议论文总量共计约1.5亿篇,并以每天添加12000余篇中外论文的速度递增。我们也可以为用户提供个性化、定制化的学者数据。欢迎来电咨询!咨询电话:010-8811{复制后删除}0370

www.globalauthorid.com

TOP

Copyright © 2019-2024 北京同舟云网络信息技术有限公司
京公网安备11010802033243号  京ICP备18003416号-3